a (source) NAT question
Hello learned people, please consider this
Scenario:
On a Fortigate 200D OS v5.4.1 I need to source NAT multiple subnets into one subnet before going into a IPSec tunnel.
e.g. 10.87.1.0/24, 10.92.22.0/24, 10.100.5.0/24 (up to some 70 subnets) need to go into the IPSec tunnel as subnet 10.123.128.0/24.
I constructed a IPv4 Policy for this using NAT and a Dynamic IP Pool in the IP Pool Configuration. The IP Pool is of type Overload with IP range 10.123.128.0 - 10.123.128.127 and option ARP Reply checked.
I noticed in testing that my source IP addresses were NATted to the new subnet with only the network modified (i.e. 172.16.100.109 is NATted to 10.123.128.109)
Questions:
1 - will I run into problems if a large number of clients (more than 500) start using this construct
2 - can I monitor the IP NAT table somewhere
3 - can I monitor for NAT conflicts/failures/mishaps
4 - should I use a larger IP pool
5a - is using 10.123.128.0 as a starting addres for the IP range a bad idea?
5b - should the IP Pool range honour network boundaries (i.e. don't use x.x.x.0 and x.x.x.255) ?
I thank you for your replies.
